In order to audit a data stream for accessing a database, a database audit device and a database server may be connected with a same switch, and a database access packet to be audited may be mirrored to the database audit device for auditing by means of the mirror function of the switch.
In a virtual environment, the database server may be a virtual machine (VM). In this case, the database audit device and a physical server in which the VM is configured as a database server may be connected with a same switch, and a database access packet to be audited received by the switch may be mirrored to the database audit device for auditing by means of the mirror function of the switch.